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In the Claims 

Please amend the claims as follows: 



1. (Currently Amended) A method for identifying presence of malicious code in 
program code within a computer system, the method comprising: 

initializing a virtual machine within the computer system, the virtual machine 
comprising a virtual personal computer (PC) implemented by software simulating 
functionality of a central processing unit and memory and a virtual operating system 
simulating functionality of a multi -threaded operating system of the computer system ; 

virtually executing a target program within the virtual machine PC so that the 
target program interacts with th e computer system only through only with an instance of 
the virtual operating system th e virtual machine ; 

analyzing behavior of the target program following upon completion of virtual 
execution to identify an occurrence of malicious code behavior and indicating in based 
upon an evaluation by the virtual machine of a behavior pattern th e occurrence of 
malicious code b e havior representing information about all functions simulated by the 
target program during virtual execution ; and 

terminating the virtual machin e PC after the analyzing process, thereby removing 
from the computer system a copy of the target program that was contained within the 
virtual machine PC . 

2. (Currently Amended) The method of claim 1, wherein the virtual PC of the 
virtual machine simulates functionality of input/output ports, and the virtual operating 
system simulates functionality of operating system data areas T and an operating system 
application program interface. 

3. (Currently Amended) The method of claim 12, wherein the virtual operating 
system is operative to simulate an application program interface call of the operating 
system by returning a correct value to the call without completing actual performance of 
the call, machine furth e r includes comprises a virtual Visual Basic e ngin e . 
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4. (Originally Filed) The method of claim 2, wherein virtual execution of the 
target program causes the target program to interact with the simulated operating system 
application program interface. 

5. (Currently Amended) The method of claim 1, wherein the target program is 
newly introduced to the computer system and initially executed by not executed prior to 
virtually executing the target program on the virtual PC . 

6. (Currently Amended) The method of claim 1, wherein after a first instance of a 
first program is analyzed by the virtual machine and a first behavior pattern is generated 
and stored in a database within coupled to the computer system, the method further 
comprising: 

determining that the first program is modified; 

analyzing the modified first program by executing the modified first program in 
the virtual machin e PC to provide a second behavior pattern; and 

comparing within the virtual machine the first behavior pattern to the second 
behavior pattern to determine whether the second behavior pattern is altered from the first 
behavior pattern in a manner indicative of presence of the malicious code in the modified 
first program . 

7. (Originally Filed) The method of claim 6, wherein a new behavior pattern is 
generated each time the first program is modified. 

8. (Currently Amended) The method of claim 6, wherein introduction of the 
malicious malignant code during modification of the first program is detected by 
comparing the first behavior pattern to the second behavior pattern and identifying altered 
bits indicating an addition of an infection procedure to the modified first program . 

9. (Currently Amended) The method of claim 6, wherein the first behavior 
pattern is identified as a match substantially cimilar to the second behavior pattern when 
the modified first program is a new version of the first program. 
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10. (Currently Amended) The method of claim 1, wherein the behavior pattern 
identifies functions executed in the virtual execution of the target program, the method 
further comprising tracking an order in which the functions are virtually executed by the 
target program within the virtual machin e PC to provide a complete record of all 
functions simulated by the target program, as if the target program were executed on the 
computer system . 

11. (Currently Amended) A method for identifying presence of malicious code in 
program code within a computer system, the method comprising: 

initializing a virtual machine within the computer system, the virtual machine 
comprising software simulating functionality of a central processing unity and memory 
and an virtual operating system simulating functionality of a multi -threaded operating 
system of the computer system including interrupt calls to th e virtual op e rating system ; 

virtually executing a target program withift the virtual machine so that the target 
program interacts with an instance of the virtual operating system rather than with the 
operating system of the computer system, whereby the malicious code is fully executed 
during virtual execution of the target program if the target program comprises the 
malicious code and th e virtual c e ntral processing unit through the - virtual machin e; 

monitoring generating a behavior pattern for ef the target program to collect 
information about all functions simulated by the target program during virtual execution 
to identify pr e s e nce of malicious code and indicating in a behavior patt e rn the occurr e nce 
of malicious cod e behavior ; and 

terminating the virtual machine upon completion of the virtual execution of the 
target program , leaving behind a record of the behavior pattern characteristic that is 
representative of operations of the analyzed target program with the computer system, 
including operations of the malicious code if the target program comprises the malicious 
code . 

12. (Originally Filed) The method of claim 11, wherein the record is in a 
behavior register in the computer system. 
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13. (Currently Amended) The method of claim 11, wherein after a first instance 
of a first program is analyzed by the virtual machine and a first behavior pattern is 
generated and stored in a database w4th4fl- ^coupIed to the computer system, the method 
further comprising: 

determining that the first program is modified; 

analyzing the modified first program by executing the modified first program m 
with the virtual machine to provide a second behavior pattern; and 

comparing the first behavior pattern to the second behavior pattern to determine 
whether the second behavior pattern is altered from the first behavior pattern in a manner 
indicative of presence of the malicious code in the modified first program . 

14. (Originally Filed) The method of claim 13, wherein a new behavior pattern is 
generated each time the first program is modified. 

15. (Currently Amended) The method of claim 13, wherein introduction of 
malignant the malicious code during modification of the first program is detected by 
comparing the first behavior pattern to the second behavior pattern and identifying altered 
bits indicating an addition of an infection procedure to the modified first program . 

16. (Currently Amended) The method of claim 13, wherein the first behavior 
pattern is identified as a match substantially similar to the second behavior pattern when 
the modified first program is a new version of the first program. 

17. (Currently Amended) The method of claim 13, wherein the behavior pattern 
identifies all functions executed m during the virtual execution of the target progranMhe 
method further comprising tracking an order in which the functions are virtually ex e cut e d 
by th e targ e t program within the virtual machine and records an order of simulation of the 
functions. 
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18. (New) A memory storage device comprising computer-executable steps 
for identifying the presence of malicious code in program code in a computer system, 
comprising: 

initializing a virtual machine for the computer system, the virtual machine 
comprising a virtual personal computer (PC) implemented by software operative to 
simulate functionality of a central processing unit and memory and a virtual operating 
system operative to simulate functionality of an operating system for the computer 
system; 

executing a target program within the virtual PC so that the target program 
completes a virtual execution by interacting only with an instance of the virtual operating 
system; 

generating a behavior pattern by completing virtual execution of the target 
program within the virtual PC, the behavior pattern representative of operational 
functions completed by the target program during virtual execution, including at least one 
of virtual operating system calls, Input/Output functions and program functions supported 
by the target program; 

upon completion of virtual execution, operating the virtual machine to compare 
the behavior pattern generated by virtual execution of the target program to a behavior 
pattern representative of operations by the malicious code to identify an occurrence of 
malicious code behavior; and 

in the event that the comparison process results in a match representing an 
identification of malicious code behavior by the target program, then identifying the 
target program as comprising the malicious code. 

19. (New) The memory storage device of Claim 18 further comprising the 
computer-executable step of removing the target program from the computer system in 
response to an identification of the target program comprising malicious code. 
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20. (New) A memory storage device comprising computer-executable steps 
for identifying the presence of malicious code in program code in a computer system, 
comprising: 

executing a target program within a virtual personal computer (PC) so that the 
target program completes a virtual execution by interacting only with an instance of a 
virtual operating system, the virtual PC comprising software operative to simulate 
functionality of a processor and memory, the virtual operating system operative to 
simulate functionality of a multi-threaded operating system for the computer system, the 
virtual PC and the virtual operating system operating in combination to form a virtual 
machine; 

collecting information about the behavior of the target program during virtual 
execution of the target program by the virtual machine to create a record of virtual 
operations of the target program, whereby the record reflects a plurality of operations of 
the malicious code if the target program comprises the malicious code; 

upon completion of virtual execution of the target program, analyzing the record 
to identify an occurrence of malicious code behavior by comparing the record to a 
behavior pattern representative of the operations performed by the malicious code; and 

in the event that the record matches the malicious code behavior, then identifying 
the target program as comprising the malicious code. 

21. (New) The memory storage device of Claim 20 further comprising the 
computer-executable step of removing the target program from the computer system in 
response to an identification of the target program comprising malicious code. 
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22. (New) A computer-implemented method for identifying a presence of 
malicious code in program code for a computer system, comprising the steps: 

virtually executing a target program within a virtual machine comprising a virtual 
personal computer (PC) implemented by software operative to simulate functionality of a 
processor and memory and a virtual operating system having software simulating 
functionality of an operating system for the computer system, wherein virtual execution 
of the target program comprises interactions with an instance of the virtual operating 
system; and 

creating a record of all functions simulated by the target program during virtual 
execution of the target program by the virtual machine, the record comprising a behavior 
pattern representative of the behavior of the target program as if it were executed on the 
computer system, the behavior pattern comprising characteristics of malicious code 
behavior in the event that the target program comprises the malicious code. 

23. (New) The computer-implemented method of Claim 22 further 
comprising the step of operating the virtual machine to analyze the record after 
completion of the virtual execution by the target program to identify an occurrence of a 
type of the behavior pattern representative of operations by the malicious code. 

24. (New) The computer-implemented method of Claim 23 wherein, in the 
event of an identification of an occurrence of malicious code behavior by the target 
program, the method further comprises the step of identifying the target program as 
comprising the malicious code. 

25. (New) The computer-implemented method of Claim 24 further 
comprising the step of removing the target program from the computer system in 
response to an identification of the target program comprising the malicious code. 
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